⚡ electrical engineering

Safecloud: A Distributed, Encrypted Storage Cloud for Streaming

Safecloud is a distributed, encrypted storage and streaming network that ensures privacy by splitting and encrypting files into ciphertext-only chunks across browser-based storage nodes and federated routers, utilizing a novel key hierarchy and convergent addressing to enable secure deduplication, efficient O(1) streaming, and verifiable, low-cost incentives without ever exposing plaintext or keys.

Original authors: Gregory Magarshak

Published 2026-06-10

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Gregory Magarshak

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you want to store a massive library of movies and books on the internet, but you don't trust the strangers who will be holding your shelves. You don't want them to be able to read your books, and you don't want them to be able to swap your pages for fake ones without you knowing.

Safecloud is a new system designed to solve this. It turns your web browser into a storage unit and creates a secure, encrypted network where no one—not even the people holding your data—can see what's inside.

Here is how it works, broken down into simple concepts:

1. The "Blind" Storage (The Drops)

Usually, if you rent a storage locker, the owner has a master key and can peek inside. In Safecloud, the storage units are called Drops.

The Analogy: Imagine you lock your valuables in a safe before you even leave your house. You hand the locked safe to a stranger (the Drop) to keep in their basement.
The Magic: The stranger never sees the key. They only see a locked box. They can't open it, read the contents, or even know what's inside. If they try to swap your box for a different one, the lock won't match the label, and you'll know immediately.
The Twist: These "strangers" are just regular web browser tabs. If you leave a tab open on a website, that tab can volunteer to be a Drop and store your locked boxes for free.

2. The "Master Key" and the "Magic Map" (The Cloud & Jets)

You (the Cloud) hold the only master key. You never send this key to anyone.

The Analogy: Instead of giving the stranger a key, you give them a Magic Map (called a Jet).
How it works: The Jet is a routing server. It doesn't hold your data, and it doesn't have your key. It just knows where your locked boxes are. When you want to watch a movie, the Jet tells the Drops, "Hey, bring me the box labeled 'Scene 1'." The Drop brings the locked box, and you unlock it on your own device.

3. The "One-Root" Tree (No More Key Chaos)

In many systems, if you want to share a specific chapter of a book with a friend, you have to make a whole new copy of the book with a new lock. Safecloud is smarter.

The Analogy: Imagine a family tree where every family member has a unique key. In Safecloud, there is only one master key (the Root). Every other key for every single file, every chunk, and every shared folder is mathematically derived from that one master key.
The Benefit: If you want to let a friend watch just Chapter 3 of a movie, you don't need to re-lock the whole movie. You just hand them a "sub-key" that mathematically unlocks only that specific branch of the tree. They can't unlock Chapter 4 or the audio track if you didn't give them that specific permission. It's like giving someone a key that only opens the front door, not the safe in the basement.

4. Streaming Without Downloading

Because of this "tree" structure, watching a video is incredibly fast and flexible.

The Analogy: Imagine a video is a long train. In normal encrypted systems, to get to the last car, you might have to unlock every single car from the front.
Safecloud's Way: Because the keys are mathematically linked, if you have the key for the "train station" (the start of the track), you can instantly calculate the key for any specific car (segment) without unlocking the ones before it. You can jump to the end of the movie instantly, and the system calculates the key for that exact moment in a split second.

5. The "Honesty Economy" (Safebux)

How do we make sure the Drops don't just delete your boxes and run away?

The Analogy: Imagine a game of "Show Me." Every so often, the Jet asks a Drop, "Show me the box labeled 'Scene 1'." The Drop has to prove it still has the box by signing a digital receipt.
The Reward: If the Drop proves it has the box, it earns points called Safebux. If it can't produce the box, it loses points and gets kicked out. This creates a system where it's cheaper and easier to be honest than to cheat. Unlike other systems that require massive, slow computer processing to prove storage, Safecloud just requires a simple digital signature, making it much faster and cheaper.

Summary of What Makes It Special

Privacy First: The people storing your data literally cannot see it.
Browser-Based: You don't need special hardware; your browser tab can be a storage provider.
Fine-Grained Control: You can share a 5-minute preview of a movie or just the subtitles without sharing the whole file.
Efficient: It uses math to skip steps, allowing for instant "seeking" in videos and automatic deduplication (if two people upload the same file, the system only stores one locked copy, saving space).

The Bottom Line: Safecloud is a way to build a global storage network where the people holding your data are "blind" to its contents, the system is fast enough for streaming video, and the economics are designed so that being honest is the most profitable path.

Technical Summary: Safecloud

Problem Statement

Decentralized storage networks face a fundamental trust dilemma: they require untrusted third parties to store data without those parties being able to read, alter, or hold the data hostage. Existing solutions address parts of this problem but fail to integrate them fully. Content-addressed systems (e.g., IPFS) ensure data integrity but lack native encryption and pricing mechanisms. Incentivized networks (e.g., Filecoin, Storj) provide economic models and proofs of storage but rely on dedicated infrastructure operators and often require data to be encrypted before being sealed, adding complexity. Crucially, none of these systems allow the storage provider to be an ordinary, untrusted web browser tab, nor do they offer a unified architecture for encrypted, random-access streaming with fine-grained monetization.

Methodology

Safecloud proposes a distributed, encrypted storage and streaming network where nodes providing storage never observe plaintext and never hold decryption keys. The architecture relies on three distinct roles:

The Cloud: The owner's or authorized grantee's SDK running in a browser. It holds the root secret, splits files, encrypts chunks, and manages keys.
Jets: Federated routing servers (Node.js) that match chunks to storage nodes, serve retrieval requests, and verify authorization. They never see plaintext.
Drops: Browser tabs that store encrypted chunks in IndexedDB. They serve data on request but possess no keys and cannot read the content.

The system is built upon five core cryptographic and architectural pillars:

1. One-Root Key Hierarchy with Derivation Agreement

All keys in the system are deterministically derived from a single 32-byte root secret using HKDF-SHA256 with domain-separated labels.

Structure: A root $r$ generates an encryption root $e$ and an access root $a$ . From $e$ , subtree keys $k_{sub}^{[S,E)}$ are derived for specific ranges $[S, E)$ . Finally, chunk keys $k_i$ and IVs $v_i$ are derived from the subtree key using the relative index.
Significance: This allows an owner to delegate a specific range of a file to a grantee by sharing only the subtree key. The grantee can derive the exact same chunk keys and IVs as the owner without ever knowing the root secret, enabling range delegation without re-encryption.

2. Convergent Content Addressing with Blind Verifiability

Because key derivation is deterministic, identical content under the same root produces identical ciphertext and Content Identifiers (CIDs).

Mechanism: The CID is computed over the authenticated ciphertext (ciphertext + GCM tag).
Blind Verifiability: A Drop can verify it holds the correct chunk by recomputing the CID from the stored bytes and comparing it to the requested CID. This verification requires no keys and reveals no plaintext, allowing untrusted nodes to confirm data integrity.
Deduplication: This enables deduplication of re-uploads and shared versions within the same owner's root scope, while preventing cross-user deduplication attacks common in global convergent encryption.

3. Three Parallel Trees Over One Navigation Path

Safecloud utilizes a single link-path addressing scheme (e.g., [track, data, 0, 1]) that simultaneously indexes three distinct trees:

Public Merkle Tree: For integrity verification of chunk CIDs.
Top-Down Key-Derivation Tree: For confidentiality, allowing key derivation from root to chunk.
Access Tree: For authorization, containing signed delegations.
This structure ensures that a single path locates a chunk's integrity proof, its decryption key, and its access grant simultaneously.

4. Streaming via Top-Down Derivation

The key hierarchy functions as a streaming index.

Random Access: A player holding a subtree key can derive the key for any segment in $O(1)$ time without re-traversing from the root or fetching previous chunks.
Parallel Tracks: Files are treated as sets of independent subtrees (e.g., video, audio, captions). A grantee can be given access to the caption track without the video track, or a specific segment range, without re-encrypting the file.
Monetization: This enables per-track and per-segment unlocking, allowing for fine-grained monetization models (e.g., renting a specific chapter) that were previously difficult in encrypted storage networks.

5. Verifiable, Zero-Sum Storage Economy

The network uses a "Safebux" economy settled via OpenClaiming trustlines.

Incentives: Drops earn Safebux for storage; Jets earn for routing.
Proof of Storage: Instead of Filecoin's computationally expensive "sealing" (slow, sequential encoding), Safecloud uses lightweight challenge-response signatures. A Jet challenges a Drop to sign a (CID, nonce) pair. Failure to respond results in stake slashing under a "Proof-of-Corruption" discipline.
Cost Efficiency: This approach is argued to be structurally cheaper than proof-of-replication because confidentiality is intrinsic (data is encrypted before storage), removing the need for a separate encryption step before sealing.

Results and Implementation Status

The paper presents a theoretical framework and a reference implementation with specific claims regarding the implemented core versus designed components:

Implemented: The core cryptographic pipeline is fully implemented, including deterministic key derivation, AES-256-GCM encryption with position-binding, CIDv1 computation, the public Merkle tree, range capability derivation, and the Cloud/Drop/Jet communication protocols using Prolly trees and Bloom filters for inventory reconciliation.
Designed/In Progress: The economic settlement layer (OpenClaiming verification), proof-of-storage challenge signing, erasure coding (currently using replication), and Jet-to-Jet peering are specified but not yet enforced in the current build.
Theoretical Proofs: The paper provides formal proofs for:
- Derivation Agreement: Owners and grantees derive identical keys for delegated ranges.
- Delegation Containment: Grantees cannot derive keys outside their granted range.
- Blind Verifiability: Drops can verify chunk integrity without keys.
- Retrieval Soundness: Merkle-verified retrieval detects any substitution or corruption.

Significance

Safecloud distinguishes itself by placing both supply (storage) and demand (consumption) inside browser sessions, allowing any visitor with an open tab to become a storage provider without installation. It uniquely combines:

End-to-End Encryption: Storage providers see only opaque ciphertext.
Efficient Streaming: Random-access decryption via top-down key derivation.
Fine-Grained Access Control: Per-track and per-segment delegation without re-encryption.
Low-Cost Verification: A storage economy based on lightweight signatures rather than heavy computational sealing.

The paper concludes that Safecloud offers a novel combination of random-access decryptable streaming and per-segment monetization not found in prior encrypted storage networks. It serves as a substrate for Safecloud 2.0, which aims to extend these principles from verifiable storage to verifiable computation.